[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Syncrepl - ldap_bind: Invalid credentials error



--On Tuesday, June 01, 2010 9:51 AM +0100 "Gocher, Mark" <Mark.Gocher.1@city.ac.uk> wrote:



I'm receiving the following error on my consumer, using logging -d
stats + args + trace + sync 2> /var/log/ldap



@(#) $OpenLDAP: slapd 2.4.22 (May 21 2010 12:10:42) $

        @cambridge:/usr/local/openldap-2.4.22/servers/slapd

slapd starting

slap_client_connect: URI=ldap://oxford.unix1.city.ac.uk:389
DN="cn=replicator,dc=city,dc=ac,dc=uk" ldap_sasl_bind_s failed (49)

Error 49 says that an invalid password was provided (or that the DN isn't right).

I have created the uid for replicator and repeated this search with the
'access to attrs=userPassword' line commented out on the provider to
ensure that the userPassword for replicator is clear text 'secret'. I
can also perform this search from the consumer successfully.


Your provider conf file is a mess. It has a mix of global and database specific directives peppered through it. You load modules after using them, etc. I would spend some time cleaning up your provider's configuration (and possible the replica one too, I didn't look at it closely).

Provider ldap.conf:

database        bdb

suffix          "dc=city,dc=ac,dc=uk"

rootdn          "cn=DSAmgr,dc=city,dc=ac,dc=uk"

rootpw         {CRYPT}aZmvWMwFgg.vk



Crypt is non portable.  You should use SSHA or similar.



directory       /var/opt/csw/openldap-data     

index   default         pres,eq,sub

index   objectClass     eq

index   cn

index   sn

index   uid

access to *

        by dn.base="cn=replicator,dc=city,dc=ac,dc=uk" read

        by * break



access to attrs=userPassword

       by anonymous auth

       by * none



access to *

        by * read



modulepath /usr/local/openldap-2.4.22

moduleload back_bdb.la

moduleload accesslog.la

moduleload syncprov.la

database bdb

suffix cn=accesslog

directory /var/opt/csw/accesslog

rootdn cn=accesslog

index default eq

index objectClass,reqEnd,reqResult,reqStart



overlay syncprov

syncprov-nopresent TRUE

syncprov-reloadhint TRUE

limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited
time.hard=unlimited size.soft=unlimited size.hard=unlimited

#      database bdb

#      suffix "dc=dc=city,dc=ac,dc=uk"

#      rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk"

index entryCSN eq

index entryUUID eq

overlay syncprov

syncprov-checkpoint 1000 60

overlay accesslog

logdb cn=accesslog

logops writes

logsuccess TRUE

logpurge 99+00:00 00+00:01



# Let the replica DN have limitless searches

limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited
time.hard=unlimited size.soft=unlimited size.hard=unlimited

database monitor



















































--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration